There is a question the auditor asks with disturbing regularity in organisations that present themselves as technically serious. The question is this · who decided this.
. The answers arrive in a predictable order · the committee decided it, the previous management approved it, the technical team determined it. When I press for the specific person, silence follows. Or rotation. Or the official who is no longer here.
Institutional opacity with the appearance of governance
What those answers describe has a technical name · institutional opacity with the appearance of governance. The organisation has policies, committees, minutes, reports — and behind the critical decisions there are no identifiable actors. That opacity is rarely corruption. It is almost always a cultural way of covering individual risk at the expense of collective traceability. If no one signs, no one stands behind it. If no one stands behind it, no one can be called to account.
This criterion develops the actor in Criterion 02. DORA assigns the management body ultimate responsibility for ICT risk in the financial entities within its scope; operational tasks may be distributed, but governance responsibility remains (Art. 5). In another context, the FCA confirmed the ban and a fine of 1,1 million pounds on the former chief executive of Barclays for a lack of integrity and misleading statements (FCA, 2025). The two cases show the same thing from different perspectives · the organisational chart does not dissolve the responsibility assigned by regulation.
Three signature pathologies
Pathology 01 · the collective signature with no real signatory. The document says approved by the committee. Seven members. None takes individual responsibility. If the decision goes wrong, the cost is spread until it becomes invisible. The minutes exist. Individual accountability was diluted by design.
Pathology 02 · the rotating signature that breaks continuity. Decisions are signed, but the signatory changes every six months. Three years later, none of those who signed remains in the organisation. Traceability exists on paper and is operationally unattainable · the critical decision was signed by someone with no obligation to answer for it and, probably, no memory of the context.
Pathology 03 · the signature of the consultant who completed the project. The external consultant signs the report, collects the fees, closes the contract. Three years later, when the incident points back to their recommendation, the contractual relationship has already expired. Their signature was real at the time. Today it is ink with no obligation behind it.
When a machine decides
The question of this decade is direct · if an AI agent made the technical decision, who is the identifiable accountable person? The doctrine answers without mystery · the person accountable for the automated decision is the one who allowed it to be automated. The person who defined the thresholds. The person who approved deployment. The person who had the authority to stop it and chose not to look at it. AI can decide quickly. It cannot take responsibility.
The Australian Robodebt scheme brought that question into the public record. The Royal Commission documented failures in design, legality, advice and oversight surrounding an automated decision (Robodebt, 2023). The system executed; the decisions that enabled and sustained it remained human and institutional.
The operational rule requires a person accountable for the system and a log proportionate to the impact · relevant input data, outcome, version, controls applied, human review where appropriate and authority to intervene. Not every output requires an individual signature; every decision architecture needs an identifiable accountable role.
The five fields of the verifiable professional
The identifiable accountable person is more than a position on an organisational chart · they are a verifiable professional. Five consultable fields define them.
Field 01 · verified identity. Verifiable name, declared role. Without this field, the other four have no foundation.
Field 02 · documented track record. Signed projects, reports with identifiable authorship, roles with dates and verifiable organisations. A track record is demonstrated through accumulated, consultable authorship — not through the length of a CV.
Field 03 · technical currency. Latest formal knowledge update, with a date, subject and sufficient depth for the role. Competence is not presumed from seniority or a job title; it is demonstrated against the decisions the role must make.
Field 04 · operational evidence. Projects with a specific role · which organisation — or which sector, if confidentiality applies — what project, what documented outcome, when.
Field 05 · current ethical standing. Relevant conflicts of interest declared and a verifiable background within applicable privacy and confidentiality limits.
An electronic or cryptographic signature can link identity, document and date when the infrastructure and key management are reliable. It does not replace the signatory's authority or competence. First, there must be someone empowered to answer for it; then the means of preserving the evidence of their signature is chosen.
The criterion test
Identify a significant technical decision signed in the last quarter under your direction. Find the signature and apply three checks.
Check one · is the signatory still in the organisation — or does the decision have a documented successor, with a handover record and date? Expected answer · yes, in either form.
Check two · was the signatory's authority for that decision documented before the decision? Expected answer · a formal delegation dated before the signature. Authority reconstructed after the fact is pathology one with better manners.
Check three · can the signatory be called to account today · is there a current obligation, contractual or role-based, to answer for that decision? Expected answer · yes, with a documented channel.
The three answers allow accountability to be reconstructed. A vacancy does not in itself prove a material failure, but it shows exactly where the decision lost its owner and what must be corrected.